@phnx-labs/agents-cli 1.22.47 → 1.22.50

package/dist/commands/accounts.js

@@ -1,12 +1,15 @@
+import * as fs from 'fs';
+import * as path from 'path';
 import chalk from 'chalk';
-import { password } from '@inquirer/prompts';
+import { password, select } from '@inquirer/prompts';
+import { resolveClaudeSetupToken } from '../lib/claude-account-token.js';
 import { setHelpSections } from '../lib/help.js';
 import { readMeta, updateMeta } from '../lib/state.js';
 import { ALL_AGENT_IDS, getAccountInfo, resolveAgentName } from '../lib/agents.js';
 import { getGlobalDefault, getVersionHomePath, listInstalledVersions } from '../lib/installations/versions.js';
 import { assertNativeAccountNameable, nativeAccountCapability, nativeIdentityKey } from '../lib/account-capabilities.js';
 import { collectRunCandidates } from '../lib/accounting/rotate.js';
-import { isInteractiveTerminal } from './utils.js';
+import { isInteractiveTerminal, isPromptCancelled, requireInteractiveSelection } from './utils.js';
 import { buildSwitchAccountChoices, formatAccountLimits, pickSwitchAccount } from './run-account-picker.js';
 import { profileExists, readProfile } from '../lib/profiles.js';
 import { pushBundleToHost } from '../lib/secrets/push.js';
@@ -15,7 +18,7 @@ import { resolveRemoteOsSync } from '../lib/hosts/remote-os.js';
 import { runDevicesAccounts } from './ssh.js';
 import { discoverNativeAccounts } from '../lib/account-catalog.js';
 import { readAndResolveBundleEnv } from '../lib/secrets/bundles.js';
-import { getAccountProvider, listAccountProviders } from '../lib/account-provider-registry.js';
+import { getAccountProvider, listAccountProviders, providerAuthenticatesHarness } from '../lib/account-provider-registry.js';
 import { accountBindings, addAccount, addNativeAccount, bindAccount, findAccount, findUnifiedAccount, inspectAccount, labelNativeAccount, listNativeAccounts, readAccountRegistry, removeAccount, renameAccount, setAccountSecret, unbindAccount } from '../lib/account-registry.js';
 function cleanCommandError(command, err) {
     command.error(err instanceof Error ? err.message : String(err), { exitCode: 1, code: 'accounts.error' });
@@ -66,6 +69,33 @@ export function classifyAttachTarget(target) {
         return { kind: 'device-agent', agent };
     throw new Error(`Unknown attach target '${target}'. Expected an installed <agent>@<version>, a harness id, or an existing custom harness profile.`);
 }
+/**
+ * Persist the attached setup-token to a per-version `.oauth_token` file so an
+ * INTERACTIVE Claude launch on a keychain-less Linux worker can authenticate from it.
+ * Headless runs inject the token via `buildExecEnv`, but an interactive launch defers to
+ * the per-version login (`claudeAdapter.applyExecConfigEnv`), and the shim's Linux fallback
+ * (`claudeAdapter.shimConfigEnvBash`) reads exactly this file. Without writing it, a
+ * freshly-attached setup-token was invisible to interactive runs on a worker. macOS keeps
+ * the credential in the keychain, so `resolveClaudeSetupToken` returns null there and this
+ * is a no-op off Linux.
+ */
+export function writeClaudeInteractiveOauthToken(target, targetAgent) {
+    if (process.platform !== 'linux' || targetAgent !== 'claude' || target.kind !== 'installation')
+        return;
+    const versionHome = getVersionHomePath('claude', target.version);
+    const tokenPath = path.join(versionHome, '.claude', '.oauth_token');
+    const token = resolveClaudeSetupToken(versionHome);
+    // A re-point (attach B over A, or a detach) can leave no setup-token resolving for
+    // this version — B's may not be minted yet. A leftover file from the previous binding
+    // would silently authenticate interactive runs as the OLD account (the shim's Linux
+    // fallback reads it), so clear it rather than leave it stale.
+    if (!token) {
+        fs.rmSync(tokenPath, { force: true });
+        return;
+    }
+    fs.mkdirSync(path.dirname(tokenPath), { recursive: true });
+    fs.writeFileSync(tokenPath, token, { mode: 0o600 });
+}
 export function parseBundleKey(raw) {
     const colon = raw.indexOf(':');
     if (colon < 1 || colon === raw.length - 1)
@@ -93,18 +123,59 @@ async function printAccounts(json, fleet = false) {
         console.log(JSON.stringify([...records.map(account => publicAccount(inspectAccount(account.name))), ...native], null, 2));
         return;
     }
-    console.log(chalk.bold('Provider account bundles\n'));
-    if (!records.length)
-        console.log(chalk.gray("  None. Add one with 'agents accounts add <name> --provider <provider> --auth <type>'."));
-    for (const account of records) {
-        const present = inspectAccount(account.name).secretPresent ? chalk.green('ready') : chalk.red('missing on this device');
-        console.log(`  ${chalk.cyan(account.name)}  ${account.provider}  ${account.auth}  ${present}`);
+    console.log(renderAccountList(records, native));
+}
+/** Pure text renderer for `agents accounts list` — grouped, column-aligned, labels first-class. */
+export function renderAccountList(records, native) {
+    const out = [];
+    // Native logins, grouped by harness — the selection surface for `<harness>#<label>`.
+    out.push(chalk.bold('Native logins') + chalk.gray('     ') + chalk.gray('run <harness>#<label>'));
+    if (!native.length) {
+        out.push(chalk.gray('  No signed-in native accounts found.'));
+    }
+    else {
+        const byHarness = new Map();
+        for (const acct of native) {
+            const list = byHarness.get(acct.agent) ?? [];
+            list.push(acct);
+            byHarness.set(acct.agent, list);
+        }
+        const harnessW = Math.max(6, ...[...byHarness.keys()].map(h => h.length));
+        const labelW = Math.max(6, ...native.map(a => (a.name ?? '—').length));
+        const idW = Math.max(8, ...native.map(a => a.display.length));
+        let sawDefault = false;
+        for (const [harness, list] of [...byHarness.entries()].sort((a, b) => a[0].localeCompare(b[0]))) {
+            const defaultVersion = getGlobalDefault(harness);
+            list.forEach((acct, i) => {
+                const harnessCell = chalk.gray((i === 0 ? harness : '').padEnd(harnessW));
+                const rawLabel = acct.name ?? '—';
+                const labelCell = acct.name ? chalk.cyan(rawLabel.padEnd(labelW)) : chalk.gray(rawLabel.padEnd(labelW));
+                const isDefault = defaultVersion ? acct.versions.includes(defaultVersion) : false;
+                if (isDefault)
+                    sawDefault = true;
+                const marker = isDefault ? chalk.green('*') : ' ';
+                out.push(`  ${harnessCell}  ${labelCell}${marker} ${acct.display.padEnd(idW)}  ${chalk.gray(acct.versions.join(', '))}`);
+            });
+        }
+        if (sawDefault)
+            out.push(chalk.gray('\n  * default account for that harness (used when you pass neither @version nor #label)'));
+    }
+    // Provider bundles — the durable API-key/setup-token accounts, selected with `--account <name>`.
+    out.push('');
+    out.push(chalk.bold('Provider bundles') + chalk.gray('  run <harness> --account <name>'));
+    if (!records.length) {
+        out.push(chalk.gray("  None. Add one with 'agents accounts add <name> --provider <provider> --auth <type>'."));
     }
-    console.log(chalk.bold('\nNative harness logins\n'));
-    if (!native.length)
-        console.log(chalk.gray('  No signed-in native accounts found.'));
-    for (const account of native)
-        console.log(`  ${account.name ? `${chalk.cyan(account.name)} · ` : ''}${account.display}  ${account.agent}  ${account.versions.join(', ')}`);
+    else {
+        const nameW = Math.max(4, ...records.map(a => a.name.length));
+        const provW = Math.max(8, ...records.map(a => a.provider.length));
+        const authW = Math.max(10, ...records.map(a => a.auth.length));
+        for (const account of records) {
+            const present = inspectAccount(account.name).secretPresent ? chalk.green('ready') : chalk.red('missing on this device');
+            out.push(`  ${chalk.cyan(account.name.padEnd(nameW))}  ${account.provider.padEnd(provW)}  ${account.auth.padEnd(authW)}  ${present}`);
+        }
+    }
+    return out.join('\n');
 }
 function parseAuth(raw) {
     if (raw === 'api-key' || raw === 'setup-token' || raw === 'bearer-token')
@@ -116,15 +187,104 @@ function parseHarness(agentRaw) {
         throw new Error(`Unknown agent '${agentRaw}'.`);
     return agentRaw;
 }
-function providerAuthenticatesHarness(provider, auth, agent) {
+/**
+ * Fold signed-in run candidates into distinct identities — the unit a label
+ * binds to. The same account signed into several versions is ONE row, so a
+ * multi-version single-account harness never demands a selector. Candidates
+ * with no stable identity (no accountKey, no email) are dropped: there is
+ * nothing durable for a label to bind to. Default-version identity first.
+ */
+export function groupLabelIdentities(candidates, defaultVersion) {
+    const byKey = new Map();
+    for (const candidate of candidates) {
+        const key = candidate.accountKey ?? candidate.email?.toLowerCase();
+        if (!key)
+            continue;
+        const row = byKey.get(key) ?? { identityKey: key, email: null, versions: [], isDefault: false };
+        row.email ??= candidate.email;
+        row.versions.push(candidate.version);
+        if (candidate.version === defaultVersion)
+            row.isDefault = true;
+        byKey.set(key, row);
+    }
+    return [...byKey.values()].sort((a, b) => a.isDefault !== b.isDefault ? (a.isDefault ? -1 : 1) : (a.email ?? a.identityKey).localeCompare(b.email ?? b.identityKey));
+}
+/**
+ * Resolve which signed-in login a bare-harness `accounts label` call means.
+ * `collect` is injectable (the `resolveRunVersion` pattern) so tests drive the
+ * real selection path against fixture candidates.
+ */
+export async function resolveLabelIdentity(agent, accountSelector, collect = collectRunCandidates) {
+    const candidates = (await collect(agent)).filter(candidate => candidate.signedIn);
+    const identities = groupLabelIdentities(candidates, getGlobalDefault(agent));
+    if (identities.length === 0)
+        throw new Error(`No signed-in ${agent} account with a stable identity. Run the harness and complete its login first.`);
+    const needle = accountSelector?.toLowerCase();
+    if (needle) {
+        const match = identities.find(identity => identity.email?.toLowerCase() === needle || identity.identityKey.toLowerCase() === needle);
+        if (!match)
+            throw new Error(`Unknown ${agent} account '${accountSelector}'.`);
+        return { kind: 'selected', identity: match };
+    }
+    if (identities.length === 1)
+        return { kind: 'selected', identity: identities[0] };
+    return { kind: 'ambiguous', identities };
+}
+/**
+ * Body of `accounts label`, exported with the injectable candidate collector
+ * so tests exercise everything but the TTY prompt itself.
+ */
+export async function runAccountsLabel(source, label, opts, collect = collectRunCandidates) {
+    if (source.includes('@')) {
+        // <harness>@<version> pins the login by where it is signed in, so a
+        // second selector can only contradict it.
+        if (opts.account)
+            throw new Error(`'${source}' already selects one login; drop --account.`);
+        const identity = await nativeIdentityFromSource(source);
+        const account = labelNativeAccount(identity.agent, identity.identityKey, identity.identityLabel, label, identity.scope);
+        console.log(chalk.green(`Labeled ${identity.agent} account ${identity.identityLabel ?? identity.identityKey} as '${account.name}'.`));
+        return;
+    }
+    const agent = parseHarness(source);
+    assertNativeAccountNameable(agent);
+    const selection = await resolveLabelIdentity(agent, opts.account, collect);
+    let selected;
+    if (selection.kind === 'selected') {
+        selected = selection.identity;
+    }
+    else {
+        if (!isInteractiveTerminal()) {
+            requireInteractiveSelection(`Selecting the ${agent} login to label`, [
+                `agents accounts label ${agent} ${label ?? '<label>'} --account <email|id>`,
+                `agents accounts label ${agent}@<version> ${label ?? '<label>'}`,
+            ]);
+        }
+        const picked = await pickLabelIdentity(agent, selection.identities);
+        if (!picked)
+            return;
+        selected = picked;
+    }
+    const account = labelNativeAccount(agent, selected.identityKey, selected.email ?? undefined, label, nativeAccountCapability(agent).scope);
+    console.log(chalk.green(`Labeled ${agent} account ${selected.email ?? selected.identityKey} as '${account.name}'.`));
+}
+/** Prompt for the login a label should bind to. A cancelled picker writes nothing. */
+async function pickLabelIdentity(agent, identities) {
+    const idW = Math.max(0, ...identities.map(identity => (identity.email ?? identity.identityKey).length));
+    const choices = identities.map(identity => ({
+        name: [
+            (identity.email ?? identity.identityKey).padEnd(idW),
+            identity.isDefault ? chalk.green('default') : '       ',
+            chalk.gray(identity.versions.join(', ')),
+        ].join('  '),
+        value: identity.identityKey,
+    }));
     try {
-        getAccountProvider(provider).envFor(agent, auth);
-        return true;
+        const key = await select({ message: `Select the ${agent} login to label:`, choices, loop: false });
+        return identities.find(identity => identity.identityKey === key) ?? null;
     }
     catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        if (message.includes('cannot authenticate'))
-            return false;
+        if (isPromptCancelled(err))
+            return null;
         throw err;
     }
 }
@@ -288,32 +448,24 @@ export function registerAccountsCommand(program) {
             cleanCommandError(command, err);
         }
     });
-    accounts.command('label <harness> [label]')
-        .description('Label a native login independently of its installed harness version')
+    const labelCmd = accounts.command('label <source> [label]')
+        .description('Label a native login by harness or <harness>@<version>; the label binds to the account identity, not the version')
         .option('--account <email-or-id>', 'Native identity to label when the harness has multiple logins')
-        .action(async (harness, label, o, command) => {
+        .action(async (source, label, o, command) => {
         try {
-            const agent = parseHarness(harness);
-            assertNativeAccountNameable(agent);
-            const candidates = (await collectRunCandidates(agent)).filter(candidate => candidate.signedIn);
-            const needle = o.account?.toLowerCase();
-            const selected = needle
-                ? candidates.find(candidate => candidate.email?.toLowerCase() === needle || candidate.accountKey?.toLowerCase() === needle)
-                : candidates.find(candidate => candidate.version === getGlobalDefault(agent)) ?? (candidates.length === 1 ? candidates[0] : undefined);
-            if (!selected)
-                throw new Error(needle
-                    ? `Unknown ${agent} account '${o.account}'.`
-                    : `Multiple ${agent} accounts are connected; pass --account <email|id>.`);
-            const identityKey = selected.accountKey ?? selected.email?.toLowerCase();
-            if (!identityKey)
-                throw new Error(`${agent} account '${selected.version}' has no stable identity.`);
-            const account = labelNativeAccount(agent, identityKey, selected.email ?? undefined, label, nativeAccountCapability(agent).scope);
-            console.log(chalk.green(`Labeled ${agent} account ${selected.email ?? identityKey} as '${account.name}'.`));
+            await runAccountsLabel(source, label, o);
         }
         catch (err) {
             cleanCommandError(command, err);
         }
     });
+    setHelpSections(labelCmd, {
+        examples: `agents accounts label codex work
+agents accounts label codex@0.146.0 personal
+agents accounts label codex work --account you@example.com
+agents run codex#work`,
+        notes: 'The label binds to the signed-in account identity, not the version — codex#work keeps selecting that account after it moves to a newer install. One signed-in login needs no selector; with several, an interactive terminal opens a picker, while scripts pass --account or <harness>@<version>.',
+    });
     accounts.command('attach <account> <target>')
         .description('Attach a named account to a native installation or custom harness')
         .action(async (name, target) => {
@@ -351,12 +503,21 @@ export function registerAccountsCommand(program) {
             getAccountProvider(account.provider).envFor(targetAgent, account.auth);
         }
         bindAccount(name, target);
+        writeClaudeInteractiveOauthToken(t, targetAgent);
         console.log(chalk.green(`Attached ${account.name} to ${target}.`));
     });
     accounts.command('detach <account> <target>')
         .description('Remove one account attachment')
         .action((name, target) => {
         unbindAccount(name, target);
+        // With the binding gone, no setup-token resolves for this version home, so this
+        // clears any .oauth_token the attach left behind (else interactive runs would keep
+        // authenticating as the just-detached account).
+        try {
+            const t = classifyAttachTarget(target);
+            writeClaudeInteractiveOauthToken(t, t.kind === 'profile' ? t.profile.host.agent : t.agent);
+        }
+        catch { /* an unresolvable target has no version home to clean */ }
         console.log(chalk.green(`Detached ${name} from ${target}.`));
     });
     accounts.command('rename <old> <new>').description('Rename an account without changing its stable id').action((oldName, newName) => renameAccount(oldName, newName));
@@ -469,6 +630,7 @@ agents run claude`,
 agents accounts add openrouter-work --provider openrouter --auth api-key --from-secrets openrouter.ai:OPENROUTER_API_KEY
 agents accounts set-key work
 agents accounts name claude@2.1.220 work
+agents accounts label codex@0.146.0 personal
 agents accounts attach work claude@2.1.225
 agents accounts view work --json
 agents accounts switch claude

package/dist/commands/artifacts.js

@@ -20,18 +20,19 @@ import { registerArtifactsSetupCommand } from './artifacts-setup.js';
 export function registerArtifactsCommands(program) {
     const artifactsCmd = program
         .command('artifacts')
-        .description('Publish agent-made artifacts (plans, reports, visuals) to your own Cloudflare R2 and get a shareable link (~$0).');
+        .description('Publish agent-made artifacts (plans, reports, visuals) to a shareable link — managed if signed in, otherwise your Cloudflare R2.');
     registerArtifactsSetupCommand(artifactsCmd);
     registerShareCommands(artifactsCmd);
     setHelpSections(artifactsCmd, {
         examples: `
-      # One-time: provision your own endpoint (or join a teammate's)
+      # Signed in? Just publish — no Cloudflare setup
+      agents auth login
+      agents artifacts share ./out/plan.html
+
+      # Or provision your own Cloudflare endpoint (or join a teammate's)
       agents artifacts setup
       agents artifacts share join https://share.agents-cli.sh
 
-      # Publish — auto OG cover, default 30d expiry, shareable link
-      agents artifacts share ./out/plan.html
-
       # What's live in your namespace, and taking one down
       agents artifacts share list
       agents artifacts unshare my-plan-a1b2
@@ -50,7 +51,7 @@ export function registerArtifactsCommands(program) {
   agents artifacts unshare <targets...> is the nested alias of
   agents artifacts share delete. Top-level \`agents unshare\` is gone.
 
-  Full reference: apps/cli/docs/share.md.
+  Architecture: cli/docs/observability.md.
     `,
     });
     registerUnshareCommand(artifactsCmd);

package/dist/commands/attach.js

@@ -50,7 +50,7 @@ export async function attachAction(id) {
     // process on the owning machine.
     const peer = sessionRecoveryPeer(meta);
     if (peer) {
-        const routed = await runOnPeer(attachRecoveryArgs(meta), peer, { tty: true });
+        const routed = await runOnPeer(attachRecoveryArgs(meta), peer, { tty: true, sessionId: meta.id });
         if (routed === 'no-target') {
             console.error(chalk.red(`Cannot attach ${meta.shortId}: origin device ${peer} is not a registered reachable peer.`));
             process.exitCode = 1;